jakecraige

Joined 12 years ago

Karma

Submissions

Member since

Apr 17

[ my public key: https://keybase.io/jakecraige; my proof: https://keybase.io/jakecraige/sigs/Nrw1uP6Y3DPl2yHIVZnNAa5ThGQVudj4XkvA51Pfuvk ]

View on Hacker News

Recent submissions

Comment · 5 months ago

Yeah this is not universal. I bought mine

Comment · 6 months ago

Yeah, I think it's more of a British English thing. It can also mean things like "in a fight". Like: "those two guys had a big row outside the pub the other night"

Comment · 4 years ago

Another vote for SynthRiders here. I have the same complaint about Beat Saber as OP. Can be done with wrist flicks and be lazy

Synth Riders forces you to have to move your body and do large sweeping motions, it feels like dancing, AND it has online multiplayer with voice chat which regularly has groups hanging out and playing for fun

That last part makes it so much more enjoyable for me

An Explainer on Ed25519 Clamping jcraige.com

1 jakecraige 6 years ago 0 comments

Comment · 6 years ago

The main app powering coinbase.com, the “monorail”, is a Rails app backed by MongoDB. It’s typically what’s being referred to when breaking out microservices.

Historically most other services were Rails/Sinatra with Postgres. These days there’s a lot more Golang being used for new services.

There’s also some services that are serverless, using Lambda and DynamoDB but these are a minority.

Comment · 6 years ago

We (Coinbase) already sign cold storage transactions in a distributed manner so this isn’t an issue :)

Comment · 6 years ago

Brian calls this out and describes how Coinbase plans to do this in the “This will require a huge shift in how we do things. How will we get there?“ section.

> To address all of these, we will form a cross-functional team to oversee this transition. This group will identify the changes we must make to become a remote-first company (e.g., around people management, recruiting/talent, culture and connection, and documentation and async work…), host open design sessions with all of you to surface ideas, considerations, dependencies, and concerns, and partner with internal experts to redesign how all of this works for a remote-first Coinbase.

Comment · 6 years ago

It’s not assuming MITM or that the attacker can upload the signature to the site.

The attack is that the attacker can reuse the already uploaded signature in a way that allows them to get certificates issued under their account instead of the initial owner.

This blog is a little confusing about that since it does read like they are supposed to upload their own sig with the graphic used.

This post and linked IETF report is a little more clear: https://www.agwa.name/blog/2015/12

Comment · 6 years ago

Matthew Green has a related post about this speaking to “multiple encryption” where people do the same thing with ciphers. [1]

A very generic take would be that depending on the system, it may be able to be done securely, but with all crypto there be dragons.

For example, let’s say you have two hashes H1 and H2 and want to use the double hash to prove existence of a file in history. Publish the hash to a blockchain or something.

So the file is hashed H1(H2(file)). In what ways could you break this if one of the hash functions is broken?

The first way is if you want to dispute the validity of what file was hashed. If we assume they later publish the file and you have a second-preimage attack on the hash.

You can create a different file where H2(file) = H2(newFile), and because H1 is deterministic, this second file verifies. It’s now no longer clear which is the true file. While a single hash function also fails under this attack, you increase your exposure to possible attacks by introducing a second one.

If you have control over the verification procedure you can imagine a similar attack with only a break in H2 by not even using H1 to generate the output.